Commit 4af66c69 authored by Jaganath Kanakkassery's avatar Jaganath Kanakkassery Committed by Gustavo Padovan
Browse files

Bluetooth: Free the l2cap channel list only when refcount is zero 



Move the l2cap channel list chan->global_l under the refcnt
protection and free it based on the refcnt.

Signed-off-by: default avatarJaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: default avatarSyam Sidhardhan <s.syam@samsung.com>
Reviewed-by: default avatarAndrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
parent 30648372

include/net/bluetooth/l2cap.h

+0 −1
Original line number Original line Diff line number Diff line
@@ -759,7 +759,6 @@ int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid); 




struct l2cap_chan *l2cap_chan_create(void);

struct l2cap_chan *l2cap_chan_create(void);

void l2cap_chan_close(struct l2cap_chan *chan, int reason);

void l2cap_chan_close(struct l2cap_chan *chan, int reason);

void l2cap_chan_destroy(struct l2cap_chan *chan);

int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,

int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,

		       bdaddr_t *dst, u8 dst_type);

		       bdaddr_t *dst, u8 dst_type);

int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,

int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,

net/bluetooth/a2mp.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -416,7 +416,7 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) 




static void a2mp_chan_close_cb(struct l2cap_chan *chan)

static void a2mp_chan_close_cb(struct l2cap_chan *chan)

{

{

	l2cap_chan_destroy(chan);

	l2cap_chan_put(chan);

}

}





static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state)

static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state)

net/bluetooth/l2cap_core.c

+5 −3
Original line number Original line Diff line number Diff line
@@ -416,13 +416,15 @@ struct l2cap_chan *l2cap_chan_create(void) 
	return chan;

	return chan;

}

}





void l2cap_chan_destroy(struct l2cap_chan *chan)

static void l2cap_chan_destroy(struct l2cap_chan *chan)

{

{

	BT_DBG("chan %p", chan);



	write_lock(&chan_list_lock);

	write_lock(&chan_list_lock);

	list_del(&chan->global_l);

	list_del(&chan->global_l);

	write_unlock(&chan_list_lock);

	write_unlock(&chan_list_lock);





	l2cap_chan_put(chan);

	kfree(chan);

}

}





void l2cap_chan_hold(struct l2cap_chan *c)

void l2cap_chan_hold(struct l2cap_chan *c)
@@ -437,7 +439,7 @@ void l2cap_chan_put(struct l2cap_chan *c) 
	BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));

	BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));





	if (atomic_dec_and_test(&c->refcnt))

	if (atomic_dec_and_test(&c->refcnt))

		kfree(c);

		l2cap_chan_destroy(c);

}

}





void l2cap_chan_set_defaults(struct l2cap_chan *chan)

void l2cap_chan_set_defaults(struct l2cap_chan *chan)

net/bluetooth/l2cap_sock.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -823,7 +823,7 @@ static void l2cap_sock_kill(struct sock *sk) 




	/* Kill poor orphan */

	/* Kill poor orphan */





	l2cap_chan_destroy(l2cap_pi(sk)->chan);

	l2cap_chan_put(l2cap_pi(sk)->chan);

	sock_set_flag(sk, SOCK_DEAD);

	sock_set_flag(sk, SOCK_DEAD);

	sock_put(sk);

	sock_put(sk);

}

}